why not use OpenProcess and ReadProcessMemory?
Here is your thing I guess.
Code:
#include <Windows.h>
#include <iostream>
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWCH Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
typedef struct _OBJECT_ATTRIBUTES {
ULONG Length;
HANDLE RootDirectory;
PUNICODE_STRING ObjectName;
ULONG Attributes;
PVOID SecurityDescriptor;
PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
typedef struct _CLIENT_ID
{
PVOID UniqueProcess;
PVOID UniqueThread;
} CLIENT_ID, *PCLIENT_ID;
#define InitOA(ptr, root, attrib, name, desc, qos) { (ptr)->Length = sizeof(OBJECT_ATTRIBUTES); (ptr)->RootDirectory = root; (ptr)->Attributes = attrib; (ptr)->ObjectName = name; (ptr)->SecurityDescriptor = desc; (ptr)->SecurityQualityOfService = qos; }
typedef NTSYSAPI NTSTATUS(NTAPI * __ntOpenProcess)(
PHANDLE ProcessHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PCLIENT_ID ClientId
);
typedef NTSYSAPI NTSTATUS(NTAPI * __ntReadVirtualMemory)(
HANDLE ProcessHandle,
PVOID BaseAddress,
PVOID Buffer,
ULONG NumberOfBytesToRead,
PULONG NumberOfBytesReaded
);
HANDLE get_handle()
{
auto hWindow = FindWindowA(NULL, "window"); // find window of application
if (hWindow == NULL)
return INVALID_HANDLE_VALUE;
CLIENT_ID uPid = { NULL };
GetWindowThreadProcessId(hWindow, ( PDWORD )&uPid.UniqueProcess); // Get pid from window handle
auto ntDll = LoadLibraryA("ntdll"); // load ntdll (windows nt functions)
if (ntDll == NULL)
return INVALID_HANDLE_VALUE;
auto openProc = (__ntOpenProcess)GetProcAddress(ntDll, "NtOpenProcess"); // get ntopenproc
if (openProc == NULL)
return INVALID_HANDLE_VALUE;
OBJECT_ATTRIBUTES attribs;
InitOA(&attribs, NULL, NULL, NULL, NULL, NULL);
HANDLE hProc = INVALID_HANDLE_VALUE;
auto _openStatus = openProc(&hProc, PROCESS_ALL_ACCESS, &attribs, &uPid); // open it now
SetLastError(_openStatus); // set last error for correct debugging, otherwise getlasterror will be 0x0
return hProc;
}
int main()
{
printf("Trying to open handle..\n");
auto hProc = get_handle();
if (hProc != INVALID_HANDLE_VALUE)
printf("Opened handle at: 0x%X\n", hProc);
else
printf("Unable to open handle, Error Code: 0x%X\n", GetLastError());
auto hModule = LoadLibraryA("ntdll");
auto RVM = (__ntReadVirtualMemory)GetProcAddress(hModule, "NtReadVirtualMemory");
if (RVM != NULL)
printf("Could get NtReadVirtualMemory successfully\n");
else
printf("Couldn't get NtReadVirtualMemory, Error Code: 0x%X\n", GetLastError());
// usage: auto testRead = RVM(hProc, address, &buffer, sizeof(whatever), NULL);
getchar();
return 0;
}